DOCSEARCHbyAlgolia
Submit Docs

SimpleIdServer Documentation

repository·master·Indexed 21 days ago

https://github.com/simpleidserver/simpleidserver

An open-source framework for implementing identity and access management protocols, including OPENID, OAUTH2.0, SCIM2.0, UMA2.0, FAPI, and CIBA. It provides modular dotnet templates for scaffolding Identity Servers, SCIM servers, and credential issuers, with support for SQL Server, PostgreSQL, and SQLite storage backends.

Tokens
71.5K
Snippets
217
Records
306
Agent score
75%

What's inside SimpleIdServer

  1. Overview of SimpleIdServer IAM features

    master

    SimpleIdServer is an open-source .NET-based Identity and Access Management (IAM) solution. It provides capabilities across three main pillars:

    Authentication

    • Protocols: Supports OPENID, SAML2.0, and WS-Federation.
    • External Providers: Ability to configure external identity providers (e.g., Facebook).
    • Methods: Supports various methods including Mobile application, OTP Code, Email, SMS, and Login & Password.

    Authorization

    • Access Control: Implements Role-Based Access Control (RBAC) to manage user permissions across multiple applications.

    User Management

    • Provisioning: Supports automatic identity provisioning workflows via LDAP and/or SCIM 2.0 REST APIs, as well as manual provisioning workflows for end-users.
    • Central Repository: Uses a SCIM 2.0 server to store and manage users and groups.

  2. What is FAPI 2.0 and its security requirements

    master

    FAPI 2.0 (Financial-grade API) is an open standard designed for high-security environments like the financial sector. It extends OAuth 2.0 and OpenID Connect with stricter requirements to reduce the risk of unauthorized access and data breaches.

    Key security components of the FAPI 2.0 profile include:

    Advanced Client Authentication

    Mandates secure client authentication methods to ensure only trusted clients can initiate communications. Supported methods include:

    • tls_client_auth
    • self_signed_tls_client_auth

    Secure Communication

    • TLS 1.2+ Upgrade: Requires the use of TLS 1.2 or higher for all HTTPS connections to strengthen encryption against modern threats.

  4. Overview of the Form Designer UI

    master

    The Form Designer consists of four primary panels used to build and refine authentication interfaces:

    PanelPurpose
    ToolboxDrag-and-drop components (titles, paragraphs, images, etc.) onto the form canvas.
    ActionsTools for inspecting JSON, editing CSS, saving, publishing, or debugging the form.
    PropertiesEdit settings for the selected component, including CSS classes, JSON parameters, translations, and scripts.
    PreviewProvides a live rendering of the form to see changes (including translations) in real-time.

    Note on Locked Elements: Core authentication fields (like 'Login' and 'Password') are required for protocol compliance. They appear with a padlock icon in the Preview and cannot be removed from the toolbox, though their translations remain editable.

  5. What is a Realm in Simpleidserver?

    master

    A Realm is an isolated workspace within a single Simpleidserver instance. It allows you to manage multiple independent environments (such as TEST, VAL, and PRD) on one server without them interfering with each other. Each realm maintains its own independent configuration, including:

    • Clients: Independent client registrations.
    • Users: Separate user identities.
    • Groups: Isolated group memberships.
    • Security Policies: Independent security configurations.

  6. What is ACR (Authentication Context Class Reference)?

    master

    In OpenID Connect, ACR (Authentication Context Class Reference) allows a client to request a specific level or method of authentication from the identity provider.

    Clients use the acr_values parameter in an authentication request to signal security requirements, such as:

    • Requiring Multi-Factor Authentication (MFA).
    • Enforcing specific assurance levels (e.g., eIDAS LoA2).
    • Requesting specific combinations like "password + email OTP".

    SimpleIdServer allows clients to dynamically signal these requirements, and the server responds with the actual authentication methods used.

  7. What is Grant Management in FAPI 2.0

    master

    Grant Management is a capability introduced by the FAPI 2.0 standard to replace various consent management APIs used in open banking. It allows Third-Party Providers (TPPs), such as Account Information Service Providers (AISPs) or Payment Initiation Service Providers (PISPs), to manage the lifecycle of user consent.

    Key capabilities include:

    • Granting access: Returning a grant_id upon successful consent.
    • Querying: Using GET to retrieve grant details.
    • Updating: Modifying an existing grant.
    • Deletion: Revoking or deleting a grant.

    It utilizes Rich Authorization Request (RAR), which allows clients to specify detailed authorization requirements using JSON structures. For example, a client can request specific actions like list_accounts or read_balances on specific resource locations.

    {
   "type":"account_information",
   "actions":[
      "list_accounts",
      "read_balances",
      "read_transactions"
   ],
   "locations":[
      "https://example.com/accounts"
   ]
}

  8. Protect a Single-Page Application (SPA) using Authorization Code Flow with PKCE

    master
    When protecting an SPA with OpenID, use the Authorization Code Flow with PKCE (Proof Key for Code Exchange). This is the recommended approach because it provides enhanced security by using a dynamically generated code verifier and code challenge, mitigating risks associated with storing client secrets in the browser. It also supports obtaining refresh tokens to improve user experience by reducing login frequency.

  9. What data is stored in the SimpleIdServer database

    master

    The relational database manages four primary categories of data essential for the identity server's operation:

    • Identity Server Data: Core identity information including user details, group memberships, and client configurations used for access control.
    • Graphical Elements for Authentication Forms: Design components and visual assets for login interfaces, allowing for UI customization without changing the underlying authentication logic.
    • Authentication and Registration Processes: The workflow logic governing how users log in and how new accounts are created.
    • Cryptographic Keys: Sensitive keys used for encrypting and decrypting data, such as authentication cookies, to protect user sessions.

  10. Configure Credential Issuer settings

    master

    The behavior of the generated Credential Issuer project is controlled via the CredentialIssuerConfiguration.cs file. It contains two primary configuration sections:

    • CredentialConfigurations: Defines the specific credentials to be issued and the mapping rules that determine how user claims are transformed into credential attributes.
    • CredentialClaims: Defines the set of claims that the user possesses which are used during the issuance process.

  11. Understand the Radzen CSS Template in SimpleIdServer

    master
    SimpleIdServer uses the Radzen CSS template by default to provide a clean, responsive UI for authentication and registration pages. This styling is bundled into the server's content pipeline, meaning no additional NuGet packages are required to use the default look and feel. The template works by loading a base stylesheet, followed by an optional custom stylesheet, and automatically applying CSS classes to form components (like inputs, buttons, and titles) to ensure consistent styling across all authentication flows.

  12. Understand authentication flow node types

    master

    Authentication flows in SimpleIdServer are composed of four distinct node types:

    Node TypeDescription
    Authentication NodeUsed to perform user authentication (e.g., login/password). These are editable (no lock icon).
    Intermediate NodeSystem-inserted helpers (grayed out with a lock icon) used for workflows like "Reset Password" that extend basic steps.
    End Node (Editable)A terminal authentication method that can be modified (e.g., switching from password to email OTP).
    End Node (Non-Editable)A locked terminal step that cannot be altered or extended.